Medium severity · published Dec 1, 2020
CVE-2020-4126
HCL iNotes is susceptible to a sensitive cookie exposure vulnerability
5.9
CVSS
0.7%
EPSS
No
On KEV
Description
HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and iNotes versions 10.0.1 FP6 and 11.0.1 FP2 and later.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HI
Hcl Inotes · Hcltech
9.0 before 10.0.1; 11.0.0 before 11.0.1; 10.0.1; 10.0.1; 10.0.1; 10.0.1; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-4126
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-4126
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085411
More from Hcl Inotes
7.5
CVE-2022-27558
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability
7.4
CVE-2022-27547
HCL iNotes is susceptible to a link to non-existent domain vulnerability
6.5
CVE-2020-14225
HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content
6.1
CVE-2022-27546
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request
6.1
CVE-2020-14271
HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content